@rocicorp/zero 0.25.0 → 0.26.0-canary.0

package/out/zero-cache/src/auth/load-permissions.js

@@ -1,50 +1,66 @@
-import * as v from "../../../shared/src/valita.js";
-import { permissionsConfigSchema, } from "../../../zero-schema/src/compiled-permissions.js";
+import { parse } from "../../../shared/src/valita.js";
+import { permissionsConfigSchema } from "../../../zero-schema/src/compiled-permissions.js";
 import { computeZqlSpecs } from "../db/lite-tables.js";
 import { elide } from "../types/strings.js";
-export function loadPermissions(lc, replica, appID) {
-    const { permissions, hash } = replica.get(`SELECT permissions, hash FROM "${appID}.permissions"`);
-    if (permissions === null) {
-        const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;
-        lc.warn?.(`\n\n\n` +
-            `No upstream permissions deployed.\n` +
-            `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +
-            `\n\n\n`);
-        return { permissions, hash: null };
-    }
-    let obj;
-    let parsed;
-    try {
-        obj = JSON.parse(permissions);
-        parsed = v.parse(obj, permissionsConfigSchema);
-    }
-    catch (e) {
-        // TODO: Plumb the --server-version and include in error message.
-        throw new Error(`Could not parse upstream permissions: ` +
-            `'${elide(String(permissions), 100)}'.\n` +
-            `This may happen if Permissions with a new internal format are ` +
-            `deployed before the supporting server has been fully rolled out.`, { cause: e });
-    }
-    return { permissions: parsed, hash };
+function loadPermissions(lc, replica, appID) {
+  const { permissions, hash } = replica.get(
+    `SELECT permissions, hash FROM "${appID}.permissions"`
+  );
+  if (permissions === null) {
+    const appIDFlag = appID === "zero" ? "" : ` --app-id=${appID}`;
+    lc.warn?.(
+      `
+
+
+No upstream permissions deployed.
+Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.
+
+
+`
+    );
+    return { permissions, hash: null };
+  }
+  let obj;
+  let parsed;
+  try {
+    obj = JSON.parse(permissions);
+    parsed = parse(obj, permissionsConfigSchema);
+  } catch (e) {
+    throw new Error(
+      `Could not parse upstream permissions: '${elide(String(permissions), 100)}'.
+This may happen if Permissions with a new internal format are deployed before the supporting server has been fully rolled out.`,
+      { cause: e }
+    );
+  }
+  return { permissions: parsed, hash };
 }
-export function reloadPermissionsIfChanged(lc, replica, appID, current) {
-    if (current === null) {
-        return { permissions: loadPermissions(lc, replica, appID), changed: true };
-    }
-    const { hash } = replica.get(`SELECT hash FROM "${appID}.permissions"`);
-    return hash === current.hash
-        ? { permissions: current, changed: false }
-        : { permissions: loadPermissions(lc, replica, appID), changed: true };
+function reloadPermissionsIfChanged(lc, replica, appID, current) {
+  if (current === null) {
+    return { permissions: loadPermissions(lc, replica, appID), changed: true };
+  }
+  const { hash } = replica.get(`SELECT hash FROM "${appID}.permissions"`);
+  return hash === current.hash ? { permissions: current, changed: false } : { permissions: loadPermissions(lc, replica, appID), changed: true };
 }
-export function getSchema(lc, replica) {
-    const specs = computeZqlSpecs(lc, replica);
-    const tables = Object.fromEntries([...specs.values()].map(table => {
-        const { tableSpec: { name, primaryKey }, zqlSpec: columns, } = table;
-        return [name, { name, columns, primaryKey }];
-    }));
-    return {
-        tables,
-        relationships: {}, // relationships are already denormalized in ASTs
-    };
+function getSchema(lc, replica) {
+  const specs = computeZqlSpecs(lc, replica);
+  const tables = Object.fromEntries(
+    [...specs.values()].map((table) => {
+      const {
+        tableSpec: { name, primaryKey },
+        zqlSpec: columns
+      } = table;
+      return [name, { name, columns, primaryKey }];
+    })
+  );
+  return {
+    tables,
+    relationships: {}
+    // relationships are already denormalized in ASTs
+  };
 }
-//# sourceMappingURL=load-permissions.js.map
+export {
+  getSchema,
+  loadPermissions,
+  reloadPermissionsIfChanged
+};
+//# sourceMappingURL=load-permissions.js.map

package/out/zero-cache/src/auth/load-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-permissions.js","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AAEnD,OAAO,EACL,uBAAuB,GAExB,MAAM,kDAAkD,CAAC;AAG1D,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAC,KAAK,EAAC,MAAM,qBAAqB,CAAC;AAO1C,MAAM,UAAU,eAAe,CAC7B,EAAc,EACd,OAAwB,EACxB,KAAa;IAEb,MAAM,EAAC,WAAW,EAAE,IAAI,EAAC,GAAG,OAAO,CAAC,GAAG,CACrC,kCAAkC,KAAK,eAAe,CACvD,CAAC;IACF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC;QAC/D,EAAE,CAAC,IAAI,EAAE,CACP,QAAQ;YACN,qCAAqC;YACrC,mCAAmC,SAAS,2BAA2B;YACvE,QAAQ,CACX,CAAC;QACF,OAAO,EAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9B,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,wCAAwC;YACtC,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM;YACzC,gEAAgE;YAChE,kEAAkE,EACpE,EAAC,KAAK,EAAE,CAAC,EAAC,CACX,CAAC;IACJ,CAAC;IACD,OAAO,EAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,EAAc,EACd,OAAwB,EACxB,KAAa,EACb,OAAiC;IAEjC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAC,IAAI,EAAC,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,eAAe,CAAC,CAAC;IACtE,OAAO,IAAI,KAAK,OAAO,CAAC,IAAI;QAC1B,CAAC,CAAC,EAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAC;QACxC,CAAC,CAAC,EAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAc,EAAE,OAAiB;IACzD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC9B,MAAM,EACJ,SAAS,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC,EAC7B,OAAO,EAAE,OAAO,GACjB,GAAG,KAAK,CAAC;QACV,OAAO,CAAC,IAAI,EAAE,EAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAuB,CAAC,CAAC;IACnE,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,MAAM;QACN,aAAa,EAAE,EAAE,EAAE,iDAAiD;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"load-permissions.js","sources":["../../../../../zero-cache/src/auth/load-permissions.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport * as v from '../../../shared/src/valita.ts';\nimport {\n  permissionsConfigSchema,\n  type PermissionsConfig,\n} from '../../../zero-schema/src/compiled-permissions.ts';\nimport type {TableSchema} from '../../../zero-schema/src/table-schema.ts';\nimport type {Schema} from '../../../zero-types/src/schema.ts';\nimport type {Database} from '../../../zqlite/src/db.ts';\nimport {computeZqlSpecs} from '../db/lite-tables.ts';\nimport type {StatementRunner} from '../db/statements.ts';\nimport {elide} from '../types/strings.ts';\n\nexport type LoadedPermissions = {\n  permissions: PermissionsConfig | null;\n  hash: string | null;\n};\n\nexport function loadPermissions(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n): LoadedPermissions {\n  const {permissions, hash} = replica.get(\n    `SELECT permissions, hash FROM \"${appID}.permissions\"`,\n  );\n  if (permissions === null) {\n    const appIDFlag = appID === 'zero' ? '' : ` --app-id=${appID}`;\n    lc.warn?.(\n      `\\n\\n\\n` +\n        `No upstream permissions deployed.\\n` +\n        `Run 'npx zero-deploy-permissions${appIDFlag}' to enforce permissions.` +\n        `\\n\\n\\n`,\n    );\n    return {permissions, hash: null};\n  }\n  let obj;\n  let parsed;\n  try {\n    obj = JSON.parse(permissions);\n    parsed = v.parse(obj, permissionsConfigSchema);\n  } catch (e) {\n    // TODO: Plumb the --server-version and include in error message.\n    throw new Error(\n      `Could not parse upstream permissions: ` +\n        `'${elide(String(permissions), 100)}'.\\n` +\n        `This may happen if Permissions with a new internal format are ` +\n        `deployed before the supporting server has been fully rolled out.`,\n      {cause: e},\n    );\n  }\n  return {permissions: parsed, hash};\n}\n\nexport function reloadPermissionsIfChanged(\n  lc: LogContext,\n  replica: StatementRunner,\n  appID: string,\n  current: LoadedPermissions | null,\n): {permissions: LoadedPermissions; changed: boolean} {\n  if (current === null) {\n    return {permissions: loadPermissions(lc, replica, appID), changed: true};\n  }\n  const {hash} = replica.get(`SELECT hash FROM \"${appID}.permissions\"`);\n  return hash === current.hash\n    ? {permissions: current, changed: false}\n    : {permissions: loadPermissions(lc, replica, appID), changed: true};\n}\n\nexport function getSchema(lc: LogContext, replica: Database): Schema {\n  const specs = computeZqlSpecs(lc, replica);\n  const tables = Object.fromEntries(\n    [...specs.values()].map(table => {\n      const {\n        tableSpec: {name, primaryKey},\n        zqlSpec: columns,\n      } = table;\n      return [name, {name, columns, primaryKey} satisfies TableSchema];\n    }),\n  );\n  return {\n    tables,\n    relationships: {}, // relationships are already denormalized in ASTs\n  };\n}\n"],"names":["v.parse"],"mappings":";;;;AAkBO,SAAS,gBACd,IACA,SACA,OACmB;AACnB,QAAM,EAAC,aAAa,KAAA,IAAQ,QAAQ;AAAA,IAClC,kCAAkC,KAAK;AAAA,EAAA;AAEzC,MAAI,gBAAgB,MAAM;AACxB,UAAM,YAAY,UAAU,SAAS,KAAK,aAAa,KAAK;AAC5D,OAAG;AAAA,MACD;AAAA;AAAA;AAAA;AAAA,kCAEqC,SAAS;AAAA;AAAA;AAAA;AAAA,IAAA;AAGhD,WAAO,EAAC,aAAa,MAAM,KAAA;AAAA,EAC7B;AACA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,WAAW;AAC5B,aAASA,MAAQ,KAAK,uBAAuB;AAAA,EAC/C,SAAS,GAAG;AAEV,UAAM,IAAI;AAAA,MACR,0CACM,MAAM,OAAO,WAAW,GAAG,GAAG,CAAC;AAAA;AAAA,MAGrC,EAAC,OAAO,EAAA;AAAA,IAAC;AAAA,EAEb;AACA,SAAO,EAAC,aAAa,QAAQ,KAAA;AAC/B;AAEO,SAAS,2BACd,IACA,SACA,OACA,SACoD;AACpD,MAAI,YAAY,MAAM;AACpB,WAAO,EAAC,aAAa,gBAAgB,IAAI,SAAS,KAAK,GAAG,SAAS,KAAA;AAAA,EACrE;AACA,QAAM,EAAC,KAAA,IAAQ,QAAQ,IAAI,qBAAqB,KAAK,eAAe;AACpE,SAAO,SAAS,QAAQ,OACpB,EAAC,aAAa,SAAS,SAAS,MAAA,IAChC,EAAC,aAAa,gBAAgB,IAAI,SAAS,KAAK,GAAG,SAAS,KAAA;AAClE;AAEO,SAAS,UAAU,IAAgB,SAA2B;AACnE,QAAM,QAAQ,gBAAgB,IAAI,OAAO;AACzC,QAAM,SAAS,OAAO;AAAA,IACpB,CAAC,GAAG,MAAM,QAAQ,EAAE,IAAI,CAAA,UAAS;AAC/B,YAAM;AAAA,QACJ,WAAW,EAAC,MAAM,WAAA;AAAA,QAClB,SAAS;AAAA,MAAA,IACP;AACJ,aAAO,CAAC,MAAM,EAAC,MAAM,SAAS,YAAiC;AAAA,IACjE,CAAC;AAAA,EAAA;AAEH,SAAO;AAAA,IACL;AAAA,IACA,eAAe,CAAA;AAAA;AAAA,EAAC;AAEpB;"}

package/out/zero-cache/src/auth/read-authorizer.d.ts

@@ -1,7 +1,7 @@
+import type { LogContext } from '@rocicorp/logger';
 import type { JWTPayload } from 'jose';
 import type { AST } from '../../../zero-protocol/src/ast.ts';
 import type { PermissionsConfig } from '../../../zero-schema/src/compiled-permissions.ts';
-import type { LogContext } from '@rocicorp/logger';
 export type TransformedAndHashed = {
     id: string;
     transformedAst: AST;

package/out/zero-cache/src/auth/read-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAGrC,OAAO,KAAK,EAAC,GAAG,EAAY,MAAM,mCAAmC,CAAC;AACtE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kDAAkD,CAAC;AAExF,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,GAAG,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GACxC,oBAAoB,CAStB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAC/B,GAAG,CASL"}
+{"version":3,"file":"read-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAErC,OAAO,KAAK,EAAC,GAAG,EAAY,MAAM,mCAAmC,CAAC;AAEtE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kDAAkD,CAAC;AAIxF,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,GAAG,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,aAAa,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GACxC,oBAAoB,CAStB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAC/B,GAAG,CASL"}

package/out/zero-cache/src/auth/read-authorizer.js

@@ -1,104 +1,92 @@
 import { hashOfAST } from "../../../zero-protocol/src/query-hash.js";
 import { bindStaticParameters } from "../../../zql/src/builder/builder.js";
 import { simplifyCondition } from "../../../zql/src/query/expression.js";
-/**
- * Adds permission rules to the given query so it only returns rows that the
- * user is allowed to read.
- *
- * If the returned query is `undefined` that means that user cannot run
- * the query at all. This is only the case if we can infer that all rows
- * would be excluded without running the query.
- * E.g., the user is trying to query a table that is not readable.
- */
-export function transformAndHashQuery(lc, id, query, permissionRules, authData, internalQuery) {
-    const transformed = internalQuery
-        ? query // application permissions do not apply to internal queries
-        : transformQuery(lc, query, permissionRules, authData);
-    return {
-        id,
-        transformedAst: transformed,
-        transformationHash: hashOfAST(transformed),
-    };
+function transformAndHashQuery(lc, id, query, permissionRules, authData, internalQuery) {
+  const transformed = internalQuery ? query : transformQuery(lc, query, permissionRules, authData);
+  return {
+    id,
+    transformedAst: transformed,
+    transformationHash: hashOfAST(transformed)
+  };
 }
-/**
- * For a given AST, apply the read-auth rules and bind static auth data.
- */
-export function transformQuery(lc, query, permissionRules, authData) {
-    const queryWithPermissions = transformQueryInternal(lc, query, permissionRules);
-    return bindStaticParameters(queryWithPermissions, {
-        authData: authData,
-    });
+function transformQuery(lc, query, permissionRules, authData) {
+  const queryWithPermissions = transformQueryInternal(
+    lc,
+    query,
+    permissionRules
+  );
+  return bindStaticParameters(queryWithPermissions, {
+    authData
+  });
 }
 function transformQueryInternal(lc, query, permissionRules) {
-    let rowSelectRules = permissionRules.tables[query.table]?.row?.select;
-    if (!rowSelectRules || rowSelectRules.length === 0) {
-        // If there are no rules, we default to not allowing any rows to be selected.
-        lc.warn?.("No permission rules found for table '" +
-            query.table +
-            "'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.");
-        rowSelectRules = [
-            [
-                'allow',
-                {
-                    type: 'or',
-                    conditions: [],
-                },
-            ],
-        ];
-    }
-    const updatedWhere = addRulesToWhere(query.where
-        ? transformCondition(lc, query.where, permissionRules)
-        : undefined, rowSelectRules);
-    return {
-        ...query,
-        where: simplifyCondition(updatedWhere),
-        related: query.related?.map(sq => {
-            const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);
-            return {
-                ...sq,
-                subquery,
-            };
-        }),
-    };
+  let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;
+  if (!rowSelectRules || rowSelectRules.length === 0) {
+    lc.warn?.(
+      "No permission rules found for table '" + query.table + "'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows."
+    );
+    rowSelectRules = [
+      [
+        "allow",
+        {
+          type: "or",
+          conditions: []
+        }
+      ]
+    ];
+  }
+  const updatedWhere = addRulesToWhere(
+    query.where ? transformCondition(lc, query.where, permissionRules) : void 0,
+    rowSelectRules
+  );
+  return {
+    ...query,
+    where: simplifyCondition(updatedWhere),
+    related: query.related?.map((sq) => {
+      const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);
+      return {
+        ...sq,
+        subquery
+      };
+    })
+  };
 }
 function addRulesToWhere(where, rowSelectRules) {
-    return {
-        type: 'and',
-        conditions: [
-            ...(where ? [where] : []),
-            {
-                type: 'or',
-                conditions: rowSelectRules.map(([_, condition]) => condition),
-            },
-        ],
-    };
+  return {
+    type: "and",
+    conditions: [
+      ...where ? [where] : [],
+      {
+        type: "or",
+        conditions: rowSelectRules.map(([_, condition]) => condition)
+      }
+    ]
+  };
 }
-// We must augment conditions so we do not provide an oracle to users.
-// E.g.,
-// `issue.whereExists('secret', s => s.where('value', 'sdf'))`
-// Not applying read policies to subqueries in the where position
-// would allow users to infer the existence of rows, and their contents,
-// that they cannot read.
 function transformCondition(lc, cond, auth) {
-    switch (cond.type) {
-        case 'simple':
-            return cond;
-        case 'and':
-        case 'or':
-            return {
-                ...cond,
-                conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),
-            };
-        case 'correlatedSubquery': {
-            const query = transformQueryInternal(lc, cond.related.subquery, auth);
-            return {
-                ...cond,
-                related: {
-                    ...cond.related,
-                    subquery: query,
-                },
-            };
+  switch (cond.type) {
+    case "simple":
+      return cond;
+    case "and":
+    case "or":
+      return {
+        ...cond,
+        conditions: cond.conditions.map((c) => transformCondition(lc, c, auth))
+      };
+    case "correlatedSubquery": {
+      const query = transformQueryInternal(lc, cond.related.subquery, auth);
+      return {
+        ...cond,
+        related: {
+          ...cond.related,
+          subquery: query
         }
+      };
     }
+  }
 }
-//# sourceMappingURL=read-authorizer.js.map
+export {
+  transformAndHashQuery,
+  transformQuery
+};
+//# sourceMappingURL=read-authorizer.js.map

package/out/zero-cache/src/auth/read-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-authorizer.js","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,SAAS,EAAC,MAAM,0CAA0C,CAAC;AAGnE,OAAO,EAAC,oBAAoB,EAAC,MAAM,qCAAqC,CAAC;AAEzE,OAAO,EAAC,iBAAiB,EAAC,MAAM,sCAAsC,CAAC;AAOvE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAc,EACd,EAAU,EACV,KAAU,EACV,eAAkC,EAClC,QAAgC,EAChC,aAAyC;IAEzC,MAAM,WAAW,GAAG,aAAa;QAC/B,CAAC,CAAC,KAAK,CAAC,2DAA2D;QACnE,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO;QACL,EAAE;QACF,cAAc,EAAE,WAAW;QAC3B,kBAAkB,EAAE,SAAS,CAAC,WAAW,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAc,EACd,KAAU,EACV,eAAkC,EAClC,QAAgC;IAEhC,MAAM,oBAAoB,GAAG,sBAAsB,CACjD,EAAE,EACF,KAAK,EACL,eAAe,CAChB,CAAC;IACF,OAAO,oBAAoB,CAAC,oBAAoB,EAAE;QAChD,QAAQ,EAAE,QAAqC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,EAAc,EACd,KAAU,EACV,eAAkC;IAElC,IAAI,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC;IAEtE,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,6EAA6E;QAC7E,EAAE,CAAC,IAAI,EAAE,CACP,uCAAuC;YACrC,KAAK,CAAC,KAAK;YACX,oFAAoF,CACvF,CAAC;QACF,cAAc,GAAG;YACf;gBACE,OAAO;gBACP;oBACE,IAAI,EAAE,IAAI;oBACV,UAAU,EAAE,EAAE;iBACf;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAClC,KAAK,CAAC,KAAK;QACT,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC;QACtD,CAAC,CAAC,SAAS,EACb,cAAc,CACf,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,KAAK,EAAE,iBAAiB,CAAC,YAAY,CAAC;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE;YAC/B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YAC1E,OAAO;gBACL,GAAG,EAAE;gBACL,QAAQ;aACT,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,KAA4B,EAC5B,cAAsC;IAEtC,OAAO;QACL,IAAI,EAAE,KAAK;QACX,UAAU,EAAE;YACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB;gBACE,IAAI,EAAE,IAAI;gBACV,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;aAC9D;SACF;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,QAAQ;AACR,8DAA8D;AAC9D,iEAAiE;AACjE,wEAAwE;AACxE,yBAAyB;AACzB,SAAS,kBAAkB,CACzB,EAAc,EACd,IAAe,EACf,IAAuB;IAEvB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,KAAK,CAAC;QACX,KAAK,IAAI;YACP,OAAO;gBACL,GAAG,IAAI;gBACP,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;aACtE,CAAC;QACJ,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtE,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,OAAO;oBACf,QAAQ,EAAE,KAAK;iBAChB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"read-authorizer.js","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport type {JSONValue} from '../../../shared/src/json.ts';\nimport type {AST, Condition} from '../../../zero-protocol/src/ast.ts';\nimport {hashOfAST} from '../../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {bindStaticParameters} from '../../../zql/src/builder/builder.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\n\nexport type TransformedAndHashed = {\n  id: string;\n  transformedAst: AST;\n  transformationHash: string;\n};\n/**\n * Adds permission rules to the given query so it only returns rows that the\n * user is allowed to read.\n *\n * If the returned query is `undefined` that means that user cannot run\n * the query at all. This is only the case if we can infer that all rows\n * would be excluded without running the query.\n * E.g., the user is trying to query a table that is not readable.\n */\nexport function transformAndHashQuery(\n  lc: LogContext,\n  id: string,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  authData: JWTPayload | undefined,\n  internalQuery: boolean | null | undefined,\n): TransformedAndHashed {\n  const transformed = internalQuery\n    ? query // application permissions do not apply to internal queries\n    : transformQuery(lc, query, permissionRules, authData);\n  return {\n    id,\n    transformedAst: transformed,\n    transformationHash: hashOfAST(transformed),\n  };\n}\n\n/**\n * For a given AST, apply the read-auth rules and bind static auth data.\n */\nexport function transformQuery(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n  authData: JWTPayload | undefined,\n): AST {\n  const queryWithPermissions = transformQueryInternal(\n    lc,\n    query,\n    permissionRules,\n  );\n  return bindStaticParameters(queryWithPermissions, {\n    authData: authData as Record<string, JSONValue>,\n  });\n}\n\nfunction transformQueryInternal(\n  lc: LogContext,\n  query: AST,\n  permissionRules: PermissionsConfig,\n): AST {\n  let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;\n\n  if (!rowSelectRules || rowSelectRules.length === 0) {\n    // If there are no rules, we default to not allowing any rows to be selected.\n    lc.warn?.(\n      \"No permission rules found for table '\" +\n        query.table +\n        \"'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.\",\n    );\n    rowSelectRules = [\n      [\n        'allow',\n        {\n          type: 'or',\n          conditions: [],\n        },\n      ],\n    ];\n  }\n\n  const updatedWhere = addRulesToWhere(\n    query.where\n      ? transformCondition(lc, query.where, permissionRules)\n      : undefined,\n    rowSelectRules,\n  );\n  return {\n    ...query,\n    where: simplifyCondition(updatedWhere),\n    related: query.related?.map(sq => {\n      const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);\n      return {\n        ...sq,\n        subquery,\n      };\n    }),\n  };\n}\n\nfunction addRulesToWhere(\n  where: Condition | undefined,\n  rowSelectRules: ['allow', Condition][],\n): Condition {\n  return {\n    type: 'and',\n    conditions: [\n      ...(where ? [where] : []),\n      {\n        type: 'or',\n        conditions: rowSelectRules.map(([_, condition]) => condition),\n      },\n    ],\n  };\n}\n\n// We must augment conditions so we do not provide an oracle to users.\n// E.g.,\n// `issue.whereExists('secret', s => s.where('value', 'sdf'))`\n// Not applying read policies to subqueries in the where position\n// would allow users to infer the existence of rows, and their contents,\n// that they cannot read.\nfunction transformCondition(\n  lc: LogContext,\n  cond: Condition,\n  auth: PermissionsConfig,\n): Condition {\n  switch (cond.type) {\n    case 'simple':\n      return cond;\n    case 'and':\n    case 'or':\n      return {\n        ...cond,\n        conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),\n      };\n    case 'correlatedSubquery': {\n      const query = transformQueryInternal(lc, cond.related.subquery, auth);\n      return {\n        ...cond,\n        related: {\n          ...cond.related,\n          subquery: query,\n        },\n      };\n    }\n  }\n}\n"],"names":[],"mappings":";;;AAuBO,SAAS,sBACd,IACA,IACA,OACA,iBACA,UACA,eACsB;AACtB,QAAM,cAAc,gBAChB,QACA,eAAe,IAAI,OAAO,iBAAiB,QAAQ;AACvD,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB;AAAA,IAChB,oBAAoB,UAAU,WAAW;AAAA,EAAA;AAE7C;AAKO,SAAS,eACd,IACA,OACA,iBACA,UACK;AACL,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,qBAAqB,sBAAsB;AAAA,IAChD;AAAA,EAAA,CACD;AACH;AAEA,SAAS,uBACP,IACA,OACA,iBACK;AACL,MAAI,iBAAiB,iBAAiB,SAAS,MAAM,KAAK,GAAG,KAAK;AAElE,MAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAElD,OAAG;AAAA,MACD,0CACE,MAAM,QACN;AAAA,IAAA;AAEJ,qBAAiB;AAAA,MACf;AAAA,QACE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,YAAY,CAAA;AAAA,QAAC;AAAA,MACf;AAAA,IACF;AAAA,EAEJ;AAEA,QAAM,eAAe;AAAA,IACnB,MAAM,QACF,mBAAmB,IAAI,MAAM,OAAO,eAAe,IACnD;AAAA,IACJ;AAAA,EAAA;AAEF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,kBAAkB,YAAY;AAAA,IACrC,SAAS,MAAM,SAAS,IAAI,CAAA,OAAM;AAChC,YAAM,WAAW,uBAAuB,IAAI,GAAG,UAAU,eAAe;AACxE,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,MAAA;AAAA,IAEJ,CAAC;AAAA,EAAA;AAEL;AAEA,SAAS,gBACP,OACA,gBACW;AACX,SAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,GAAI,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,MACtB;AAAA,QACE,MAAM;AAAA,QACN,YAAY,eAAe,IAAI,CAAC,CAAC,GAAG,SAAS,MAAM,SAAS;AAAA,MAAA;AAAA,IAC9D;AAAA,EACF;AAEJ;AAQA,SAAS,mBACP,IACA,MACA,MACW;AACX,UAAQ,KAAK,MAAA;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY,KAAK,WAAW,IAAI,OAAK,mBAAmB,IAAI,GAAG,IAAI,CAAC;AAAA,MAAA;AAAA,IAExE,KAAK,sBAAsB;AACzB,YAAM,QAAQ,uBAAuB,IAAI,KAAK,QAAQ,UAAU,IAAI;AACpE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG,KAAK;AAAA,UACR,UAAU;AAAA,QAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,EAAA;AAEJ;"}

package/out/zero-cache/src/auth/write-authorizer.d.ts

@@ -1,7 +1,8 @@
-import { LogContext } from '@rocicorp/logger';
+import type { LogContext } from '@rocicorp/logger';
 import type { JWTPayload } from 'jose';
 import type { CRUDOp, UpsertOp } from '../../../zero-protocol/src/push.ts';
-import { Database } from '../../../zqlite/src/db.ts';
+import type { DatabaseStorage } from '../../../zqlite/src/database-storage.ts';
+import type { Database } from '../../../zqlite/src/db.ts';
 import type { ZeroConfig } from '../config/zero-config.ts';
 export interface WriteAuthorizer {
     canPreMutation(authData: JWTPayload | undefined, ops: Exclude<CRUDOp, UpsertOp>[]): Promise<boolean>;
@@ -11,7 +12,7 @@ export interface WriteAuthorizer {
 }
 export declare class WriteAuthorizerImpl implements WriteAuthorizer {
     #private;
-    constructor(lc: LogContext, config: ZeroConfig, replica: Database, appID: string, cgID: string);
+    constructor(lc: LogContext, config: ZeroConfig, replica: Database, appID: string, cgID: string, writeAuthzStorage: DatabaseStorage);
     reloadPermissions(): void;
     destroy(): void;
     canPreMutation(authData: JWTPayload | undefined, ops: Exclude<CRUDOp, UpsertOp>[]): Promise<boolean>;

package/out/zero-cache/src/auth/write-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAcrC,OAAO,KAAK,EACV,MAAM,EAIN,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAe5C,OAAO,EAAC,QAAQ,EAAC,MAAM,2BAA2B,CAAC;AAMnD,OAAO,KAAK,EAAY,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAapE,MAAM,WAAW,eAAe;IAC9B,cAAc,CACZ,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,eAAe,CACb,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,iBAAiB,IAAI,IAAI,CAAC;IAC1B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;CAC1D;AAED,qBAAa,mBAAoB,YAAW,eAAe;;gBAevD,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM;IA0Bd,iBAAiB;IASjB,OAAO;IAID,cAAc,CAClB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAsB5B,eAAe,CACnB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IA6DlC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;CAySzD"}
+{"version":3,"file":"write-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/write-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAUrC,OAAO,KAAK,EACV,MAAM,EAIN,QAAQ,EACT,MAAM,oCAAoC,CAAC;AAa5C,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,2BAA2B,CAAC;AAMxD,OAAO,KAAK,EAAY,UAAU,EAAC,MAAM,0BAA0B,CAAC;AAapE,MAAM,WAAW,eAAe;IAC9B,cAAc,CACZ,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,eAAe,CACb,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,iBAAiB,IAAI,IAAI,CAAC;IAC1B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;CAC1D;AAED,qBAAa,mBAAoB,YAAW,eAAe;;gBAevD,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,eAAe;IAqBpC,iBAAiB;IASjB,OAAO;IAID,cAAc,CAClB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAsB5B,eAAe,CACnB,QAAQ,EAAE,UAAU,GAAG,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IAmElC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;CA4UzD"}